CVE-2023-5209

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Nov 27, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-520907.8A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected instalCVE-2023-520917.8An anti-spyware engine link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected CVE-2023-520927.8A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected instalCVE-2023-520937.8An exposed dangerous function vulnerability in the Trend Micro Apex One agent could allow a local attacker to escalate privileges on affecteCVE-2023-520947.8An updater link following vulnerability in the Trend Micro Apex One agent could allow a local attacker to abuse the updater to delete an arbCVE-2023-520967.5SteVe Community ocpp-jaxb before 0.0.8 generates invalid timestamps such as ones with month 00 in certain situations (such as when an applicCVE-2023-520977.5Vulnerability of foreground service restrictions being bypassed in the NMS module.Successful exploitation of this vulnerability may affect sCVE-2023-520987.5Denial of Service (DoS) vulnerability in the DMS module. Successful exploitation of this vulnerability will affect availability.CVE-2023-520997.5Vulnerability of foreground service restrictions being bypassed in the NMS module. Successful exploitation of this vulnerability may affect CVE-2023-52106.1The AMP+ Plus WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a ReflCVE-2023-521007.5The Celia Keyboard module has a vulnerability in access control. Successful exploitation of this vulnerability may affect availability.CVE-2023-521019.1Component exposure vulnerability in the Wi-Fi module. Successful exploitation of this vulnerability may affect service availability and inte